Globalvulnerability→Government and Critical InfrastructureCRITICAL2hGlobalapt→Cryptocurrency and BlockchainCRITICAL9hGlobalmalware→Financial Services / CryptocurrencyCRITICAL10hGlobalinsider→Cloud Computing and SaaSHIGH11hGlobalvulnerability→Industrial Control Systems / Operational TechnologyCRITICAL11hGlobalransomware→Corporate/EnterpriseCRITICAL12hGlobalransomware→Retail/E-commerceHIGH14hGlobalvulnerability→Software Development and AI/ML ServicesCRITICAL15hGlobalvulnerability→Healthcare, Operational Technology, Industrial Control SystemsCRITICAL16hGlobalphishing→Enterprise/Information TechnologyHIGH17hGlobalvulnerability→Government and Critical InfrastructureCRITICAL2hGlobalapt→Cryptocurrency and BlockchainCRITICAL9hGlobalmalware→Financial Services / CryptocurrencyCRITICAL10hGlobalinsider→Cloud Computing and SaaSHIGH11hGlobalvulnerability→Industrial Control Systems / Operational TechnologyCRITICAL11hGlobalransomware→Corporate/EnterpriseCRITICAL12hGlobalransomware→Retail/E-commerceHIGH14hGlobalvulnerability→Software Development and AI/ML ServicesCRITICAL15hGlobalvulnerability→Healthcare, Operational Technology, Industrial Control SystemsCRITICAL16hGlobalphishing→Enterprise/Information TechnologyHIGH17hGlobalvulnerability→Government and Critical InfrastructureCRITICAL2hGlobalapt→Cryptocurrency and BlockchainCRITICAL9hGlobalmalware→Financial Services / CryptocurrencyCRITICAL10hGlobalinsider→Cloud Computing and SaaSHIGH11hGlobalvulnerability→Industrial Control Systems / Operational TechnologyCRITICAL11hGlobalransomware→Corporate/EnterpriseCRITICAL12hGlobalransomware→Retail/E-commerceHIGH14hGlobalvulnerability→Software Development and AI/ML ServicesCRITICAL15hGlobalvulnerability→Healthcare, Operational Technology, Industrial Control SystemsCRITICAL16hGlobalphishing→Enterprise/Information TechnologyHIGH17h
The Saudi Central Bank published updated guidance requiring all banks and fintechs to achieve maturity level 3 across all SAMA CSF domains by Q4 2025.
Overview
The Saudi Arabian Monetary Authority (SAMA) has published new cybersecurity framework guidelines that significantly raise compliance standards for financial institutions operating in the Kingdom. The updated requirements mandate that all licensed entities achieve maturity level 3 across all 12 SAMA CSF domains by Q4 2025.
Key Requirements
24/7 Security Operations Center (SOC) capability
Multi-factor authentication for all privileged accounts
Annual third-party penetration testing by certified providers
Board-level cybersecurity oversight and quarterly reporting
Supply chain risk assessments for all critical vendors
Timeline
Organizations have until December 31, 2025 to demonstrate full compliance. SAMA has indicated that non-compliant institutions may face regulatory action including fines and operational restrictions.
What This Means for Your Organization
Financial institutions should immediately conduct a gap assessment against the updated SAMA CSF requirements. Key priority areas include SOC establishment, privileged access management, and board cybersecurity governance.
🤖AI Executive Analysis📦 cached
SAMA has released updated cybersecurity framework guidelines requiring all licensed financial institutions to achieve maturity level 3 across 12 CSF domains by Q4 2025. Key mandates include 24/7 SOC operations, MFA for privileged accounts, annual penetration testing, board-level oversight, and supply chain risk assessments. Non-compliance may result in regulatory fines and operational restrictions, making immediate gap assessments critical for affected organizations.
Key Takeaways
→All SAMA-licensed financial institutions must achieve maturity level 3 across 12 CSF domains by December 31, 2025
→Mandatory requirements include 24/7 SOC capability, MFA for privileged accounts, annual third-party penetration testing, and quarterly board reporting
→Non-compliance will result in regulatory action including fines and potential operational restrictions
→Organizations must conduct supply chain risk assessments for all critical vendors as part of compliance
⚠ Saudi Impact:
This regulatory update will significantly impact all Saudi financial institutions, requiring substantial investments in security infrastructure, personnel, and governance processes. Banks, insurance companies, payment service providers, and fintech firms must prioritize SOC establishment, identity and access management upgrades, and board-level cybersecurity governance. Organizations lacking mature security programs face compressed timelines for achieving compliance, potentially requiring external consulting support and accelerated technology deployments. The supply chain assessment requirement extends compliance obligations beyond organizational boundaries to third-party vendors and service providers.
💬 Comments (0)
🔒 Please log in to comment
Be the first to comment